<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#222">
<meta name="generator" content="Hexo 5.4.0">


  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png">
  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32-next.png">
  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16-next.png">
  <link rel="mask-icon" href="/images/logo.svg" color="#222">

<link rel="stylesheet" href="/css/main.css">



<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5.15.2/css/all.min.css">
  <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/animate.css@3.1.1/animate.min.css">

<script class="hexo-configurations">
    var NexT = window.NexT || {};
    var CONFIG = {"hostname":"littlefxc.github.io","root":"/","images":"/images","scheme":"Mist","version":"8.2.2","exturl":false,"sidebar":{"position":"left","display":"post","padding":18,"offset":12},"copycode":false,"bookmark":{"enable":false,"color":"#222","save":"auto"},"fancybox":false,"mediumzoom":false,"lazyload":false,"pangu":false,"comments":{"style":"tabs","active":null,"storage":true,"lazyload":false,"nav":null},"motion":{"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"fadeInDown","post_body":"fadeInDown","coll_header":"fadeInLeft","sidebar":"fadeInUp"}},"prism":false,"i18n":{"placeholder":"搜索...","empty":"没有找到任何搜索结果：${query}","hits_time":"找到 ${hits} 个搜索结果（用时 ${time} 毫秒）","hits":"找到 ${hits} 个搜索结果"},"path":"/search.xml","localsearch":{"enable":true,"trigger":"auto","top_n_per_article":1,"unescape":false,"preload":false}};
  </script>
<meta name="description" content="filebeatfilebeat合并多行日志示例本节中的示例包括以下内容：  将Java堆栈跟踪日志组合成一个事件 将C风格的日志组合成一个事件 结合时间戳处理多行事件  Java堆栈跟踪Java示例一Java堆栈跟踪由多行组成，每一行在初始行之后以空格开头，如本例中所述: 1234Exception in thread &quot;main&quot; java.lang.NullPointer">
<meta property="og:type" content="article">
<meta property="og:title" content="filebeat">
<meta property="og:url" content="http://littlefxc.github.io/2019/08/07/filebeat/index.html">
<meta property="og:site_name" content="一年春又来">
<meta property="og:description" content="filebeatfilebeat合并多行日志示例本节中的示例包括以下内容：  将Java堆栈跟踪日志组合成一个事件 将C风格的日志组合成一个事件 结合时间戳处理多行事件  Java堆栈跟踪Java示例一Java堆栈跟踪由多行组成，每一行在初始行之后以空格开头，如本例中所述: 1234Exception in thread &quot;main&quot; java.lang.NullPointer">
<meta property="og:locale" content="zh_CN">
<meta property="article:published_time" content="2019-08-07T09:13:33.000Z">
<meta property="article:modified_time" content="2021-03-25T13:15:49.019Z">
<meta property="article:author" content="一年春又来">
<meta property="article:tag" content="filebeat">
<meta name="twitter:card" content="summary">


<link rel="canonical" href="http://littlefxc.github.io/2019/08/07/filebeat/">


<script class="page-configurations">
  // https://hexo.io/docs/variables.html
  CONFIG.page = {
    sidebar: "",
    isHome : false,
    isPost : true,
    lang   : 'zh-CN'
  };
</script>
<title>filebeat | 一年春又来</title>
  




  <noscript>
  <style>
  body { margin-top: 2rem; }

  .use-motion .menu-item,
  .use-motion .sidebar,
  .use-motion .post-block,
  .use-motion .pagination,
  .use-motion .comments,
  .use-motion .post-header,
  .use-motion .post-body,
  .use-motion .collection-header {
    visibility: visible;
  }

  .use-motion .header,
  .use-motion .site-brand-container .toggle,
  .use-motion .footer { opacity: initial; }

  .use-motion .site-title,
  .use-motion .site-subtitle,
  .use-motion .custom-logo-image {
    opacity: initial;
    top: initial;
  }

  .use-motion .logo-line {
    transform: scaleX(1);
  }

  .search-pop-overlay, .sidebar-nav { display: none; }
  .sidebar-panel { display: block; }
  </style>
</noscript>

<link rel="alternate" href="/atom.xml" title="一年春又来" type="application/atom+xml">
</head>

<body itemscope itemtype="http://schema.org/WebPage" class="use-motion">
  <div class="headband"></div>

  <main class="main">
    <header class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-container">
  <div class="site-nav-toggle">
    <div class="toggle" aria-label="切换导航栏" role="button">
        <span class="toggle-line"></span>
        <span class="toggle-line"></span>
        <span class="toggle-line"></span>
    </div>
  </div>

  <div class="site-meta">

    <a href="/" class="brand" rel="start">
      <i class="logo-line"></i>
      <h1 class="site-title">一年春又来</h1>
      <i class="logo-line"></i>
    </a>
  </div>

  <div class="site-nav-right">
    <div class="toggle popup-trigger">
        <i class="fa fa-search fa-fw fa-lg"></i>
    </div>
  </div>
</div>



<nav class="site-nav">
  <ul class="main-menu menu">
        <li class="menu-item menu-item-home"><a href="/" rel="section"><i class="home                          //首页 fa-fw"></i>首页</a></li>
        <li class="menu-item menu-item-archives"><a href="/archives/" rel="section"><i class="archive          //归档 fa-fw"></i>归档</a></li>
        <li class="menu-item menu-item-categories"><a href="/categories/" rel="section"><i class="th           //分类 fa-fw"></i>分类</a></li>
        <li class="menu-item menu-item-tags"><a href="/tags/" rel="section"><i class="tags                     //标签 fa-fw"></i>标签</a></li>
      <li class="menu-item menu-item-search">
        <a role="button" class="popup-trigger"><i class="fa fa-search fa-fw"></i>搜索
        </a>
      </li>
  </ul>
</nav>



  <div class="search-pop-overlay">
    <div class="popup search-popup"><div class="search-header">
  <span class="search-icon">
    <i class="fa fa-search"></i>
  </span>
  <div class="search-input-container">
    <input autocomplete="off" autocapitalize="off" maxlength="80"
           placeholder="搜索..." spellcheck="false"
           type="search" class="search-input">
  </div>
  <span class="popup-btn-close" role="button">
    <i class="fa fa-times-circle"></i>
  </span>
</div>
<div class="search-result-container no-result">
  <div class="search-result-icon">
    <i class="fa fa-spinner fa-pulse fa-5x"></i>
  </div>
</div>

    </div>
  </div>

</div>
        
  
  <div class="toggle sidebar-toggle" role="button">
    <span class="toggle-line"></span>
    <span class="toggle-line"></span>
    <span class="toggle-line"></span>
  </div>

  <aside class="sidebar">

    <div class="sidebar-inner sidebar-nav-active sidebar-toc-active">
      <ul class="sidebar-nav">
        <li class="sidebar-nav-toc">
          文章目录
        </li>
        <li class="sidebar-nav-overview">
          站点概览
        </li>
      </ul>

      <div class="sidebar-panel-container">
        <!--noindex-->
        <div class="post-toc-wrap sidebar-panel">
            <div class="post-toc animated"><ol class="nav"><li class="nav-item nav-level-2"><a class="nav-link" href="#filebeat"><span class="nav-text">filebeat</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#filebeat%E5%90%88%E5%B9%B6%E5%A4%9A%E8%A1%8C%E6%97%A5%E5%BF%97%E7%A4%BA%E4%BE%8B"><span class="nav-text">filebeat合并多行日志示例</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#Java%E5%A0%86%E6%A0%88%E8%B7%9F%E8%B8%AA"><span class="nav-text">Java堆栈跟踪</span></a><ol class="nav-child"><li class="nav-item nav-level-4"><a class="nav-link" href="#Java%E7%A4%BA%E4%BE%8B%E4%B8%80"><span class="nav-text">Java示例一</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#Java%E7%A4%BA%E4%BE%8B%E4%BA%8C"><span class="nav-text">Java示例二</span></a></li></ol></li><li class="nav-item nav-level-3"><a class="nav-link" href="#C%E9%A3%8E%E6%A0%BC%E7%9A%84%E6%97%A5%E5%BF%97"><span class="nav-text">C风格的日志</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E6%97%B6%E9%97%B4%E6%88%B3"><span class="nav-text">时间戳</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%BA%94%E7%94%A8%E7%A8%8B%E5%BA%8F%E4%BA%8B%E4%BB%B6"><span class="nav-text">应用程序事件</span></a></li></ol></li></ol></div>
        </div>
        <!--/noindex-->

        <div class="site-overview-wrap sidebar-panel">
          <div class="site-author site-overview-item animated" itemprop="author" itemscope itemtype="http://schema.org/Person">
  <p class="site-author-name" itemprop="name">一年春又来</p>
  <div class="site-description" itemprop="description"></div>
</div>
<div class="site-state-wrap site-overview-item animated">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
          <a href="/archives/">
        
          <span class="site-state-item-count">234</span>
          <span class="site-state-item-name">日志</span>
        </a>
      </div>
      <div class="site-state-item site-state-categories">
            <a href="/categories/">
          
        <span class="site-state-item-count">38</span>
        <span class="site-state-item-name">分类</span></a>
      </div>
      <div class="site-state-item site-state-tags">
            <a href="/tags/">
          
        <span class="site-state-item-count">125</span>
        <span class="site-state-item-name">标签</span></a>
      </div>
  </nav>
</div>



        </div>
      </div>
    </div>
  </aside>
  <div class="sidebar-dimmer"></div>


    </header>

    
  <div class="back-to-top" role="button">
    <i class="fa fa-arrow-up"></i>
    <span>0%</span>
  </div>

<noscript>
  <div class="noscript-warning">Theme NexT works best with JavaScript enabled</div>
</noscript>


    <div class="main-inner post posts-expand">


  


<div class="post-block">
  
  

  <article itemscope itemtype="http://schema.org/Article" class="post-content" lang="zh-CN">
    <link itemprop="mainEntityOfPage" href="http://littlefxc.github.io/2019/08/07/filebeat/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="image" content="/images/avatar.gif">
      <meta itemprop="name" content="一年春又来">
      <meta itemprop="description" content="">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="一年春又来">
    </span>
      <header class="post-header">
        <h1 class="post-title" itemprop="name headline">
          filebeat
        </h1>

        <div class="post-meta-container">
          <div class="post-meta">
    <span class="post-meta-item">
      <span class="post-meta-item-icon">
        <i class="far fa-calendar"></i>
      </span>
      <span class="post-meta-item-text">发表于</span>

      <time title="创建时间：2019-08-07 17:13:33" itemprop="dateCreated datePublished" datetime="2019-08-07T17:13:33+08:00">2019-08-07</time>
    </span>
      <span class="post-meta-item">
        <span class="post-meta-item-icon">
          <i class="far fa-calendar-check"></i>
        </span>
        <span class="post-meta-item-text">更新于</span>
        <time title="修改时间：2021-03-25 21:15:49" itemprop="dateModified" datetime="2021-03-25T21:15:49+08:00">2021-03-25</time>
      </span>
    <span class="post-meta-item">
      <span class="post-meta-item-icon">
        <i class="far fa-folder"></i>
      </span>
      <span class="post-meta-item-text">分类于</span>
        <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
          <a href="/categories/ELK/" itemprop="url" rel="index"><span itemprop="name">ELK</span></a>
        </span>
    </span>

  
</div>

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">
        <h2 id="filebeat"><a href="#filebeat" class="headerlink" title="filebeat"></a>filebeat</h2><h2 id="filebeat合并多行日志示例"><a href="#filebeat合并多行日志示例" class="headerlink" title="filebeat合并多行日志示例"></a>filebeat合并多行日志示例</h2><p>本节中的示例包括以下内容：</p>
<ul>
<li>将Java堆栈跟踪日志组合成一个事件</li>
<li>将C风格的日志组合成一个事件</li>
<li>结合时间戳处理多行事件</li>
</ul>
<h3 id="Java堆栈跟踪"><a href="#Java堆栈跟踪" class="headerlink" title="Java堆栈跟踪"></a>Java堆栈跟踪</h3><h4 id="Java示例一"><a href="#Java示例一" class="headerlink" title="Java示例一"></a>Java示例一</h4><p>Java堆栈跟踪由多行组成，每一行在初始行之后以空格开头，如本例中所述:</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">Exception in thread &quot;main&quot; java.lang.NullPointerException</span><br><span class="line">        at com.example.myproject.Book.getTitle(Book.java:16)</span><br><span class="line">        at com.example.myproject.Author.getBookTitles(Author.java:25)</span><br><span class="line">        at com.example.myproject.Bootstrap.main(Bootstrap.java:14)</span><br></pre></td></tr></table></figure>

<p>要将这些行整合到Filebeat中的单个事件中，请使用以下多行配置：</p>
<figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">multiline.pattern:</span> <span class="string">&#x27;^[[:space:]]&#x27;</span></span><br><span class="line"><span class="attr">multiline.negate:</span> <span class="literal">false</span></span><br><span class="line"><span class="attr">multiline.match:</span> <span class="string">after</span></span><br></pre></td></tr></table></figure>

<p>此配置将以空格开头的所有行合并到上一行。</p>
<h4 id="Java示例二"><a href="#Java示例二" class="headerlink" title="Java示例二"></a>Java示例二</h4><p>下面是一个Java堆栈跟踪日志，稍微复杂的例子:</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">Exception in thread &quot;main&quot; java.lang.IllegalStateException: A book has a null property</span><br><span class="line">       at com.example.myproject.Author.getBookIds(Author.java:38)</span><br><span class="line">       at com.example.myproject.Bootstrap.main(Bootstrap.java:14)</span><br><span class="line">Caused by: java.lang.NullPointerException</span><br><span class="line">       at com.example.myproject.Book.getId(Book.java:22)</span><br><span class="line">       at com.example.myproject.Author.getBookIds(Author.java:35)</span><br><span class="line">       ... 1 more</span><br></pre></td></tr></table></figure>

<p>要将这些行整合到Filebeat中的单个事件中，请使用以下多行配置：</p>
<figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">multiline.pattern:</span> <span class="string">&#x27;^[[:space:]]+(at|\.&#123;3&#125;)\b|^Caused by:&#x27;</span></span><br><span class="line"><span class="attr">multiline.negate:</span> <span class="literal">false</span></span><br><span class="line"><span class="attr">multiline.match:</span> <span class="string">after</span></span><br></pre></td></tr></table></figure>

<p>此配置解释如下：</p>
<ul>
<li>将以空格开头的所有行合并到上一行</li>
<li>并把以Caused by开头的也追加到上一行</li>
</ul>
<h3 id="C风格的日志"><a href="#C风格的日志" class="headerlink" title="C风格的日志"></a>C风格的日志</h3><p>一些编程语言在一行末尾使用反斜杠 <code>\</code> 字符，表示该行仍在继续，如本例中所示:</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="built_in">printf</span> (<span class="string">&quot;%10.10ld  \t %10.10ld \t %s\</span></span><br><span class="line"><span class="string">  %f&quot;</span>, w, x, y, z );</span><br></pre></td></tr></table></figure>

<p>要将这些行整合到Filebeat中的单个事件中，请使用以下多行配置：</p>
<figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">multiline.pattern:</span> <span class="string">&#x27;\\$&#x27;</span></span><br><span class="line"><span class="attr">multiline.negate:</span> <span class="literal">false</span></span><br><span class="line"><span class="attr">multiline.match:</span> <span class="string">before</span></span><br></pre></td></tr></table></figure>

<p>此配置将以\字符结尾的任何行与后面的行合并。</p>
<h3 id="时间戳"><a href="#时间戳" class="headerlink" title="时间戳"></a>时间戳</h3><p>来自Elasticsearch等服务的活动日志通常以时间戳开始，然后是关于特定活动的信息，如下例所示：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">[2015-08-24 11:49:14,389][INFO ][env                      ] [Letha] using [1] data paths, mounts [[&#x2F;</span><br><span class="line">(&#x2F;dev&#x2F;disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]</span><br></pre></td></tr></table></figure>

<p>要将这些行整合到Filebeat中的单个事件中，请使用以下多行配置：</p>
<figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">multiline.pattern:</span> <span class="string">&#x27;^\[[0-9]&#123;4&#125;-[0-9]&#123;2&#125;-[0-9]&#123;2&#125;&#x27;</span></span><br><span class="line"><span class="attr">multiline.negate:</span> <span class="literal">true</span></span><br><span class="line"><span class="attr">multiline.match:</span> <span class="string">after</span></span><br></pre></td></tr></table></figure>

<p>此配置使用negate: true和match: after设置来指定任何不符合指定模式的行都属于上一行。</p>
<h3 id="应用程序事件"><a href="#应用程序事件" class="headerlink" title="应用程序事件"></a>应用程序事件</h3><p>有时您的应用程序日志包含以自定义标记开始和结束的事件，如以下示例：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">[2015-08-24 11:49:14,389] Start new event</span><br><span class="line">[2015-08-24 11:49:14,395] Content of processing something</span><br><span class="line">[2015-08-24 11:49:14,399] End event</span><br></pre></td></tr></table></figure>

<p>要在Filebeat中将其整合为单个事件，请使用以下多行配置：</p>
<figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">multiline.pattern:</span> <span class="string">&#x27;Start new event&#x27;</span></span><br><span class="line"><span class="attr">multiline.negate:</span> <span class="literal">true</span></span><br><span class="line"><span class="attr">multiline.match:</span> <span class="string">after</span></span><br><span class="line"><span class="attr">multiline.flush_pattern:</span> <span class="string">&#x27;End event&#x27;</span></span><br></pre></td></tr></table></figure>

<p>此配置把指定字符串开头，指定字符串结尾的多行合并为一个事件。</p>

    </div>

    
    
    

    <footer class="post-footer">
          <div class="post-tags">
              <a href="/tags/filebeat/" rel="tag"># filebeat</a>
          </div>

        

          <div class="post-nav">
            <div class="post-nav-item">
                <a href="/2019/07/24/SpringBoot%E6%95%B4%E5%90%88ES%E7%9A%84JavaRestClient/" rel="prev" title="SpringBoot整合ES的JavaRestClient">
                  <i class="fa fa-chevron-left"></i> SpringBoot整合ES的JavaRestClient
                </a>
            </div>
            <div class="post-nav-item">
                <a href="/2019/08/07/elasticsearch/" rel="next" title="elasticsearch">
                  elasticsearch <i class="fa fa-chevron-right"></i>
                </a>
            </div>
          </div>
    </footer>
  </article>
</div>







<script>
  window.addEventListener('tabs:register', () => {
    let { activeClass } = CONFIG.comments;
    if (CONFIG.comments.storage) {
      activeClass = localStorage.getItem('comments_active') || activeClass;
    }
    if (activeClass) {
      const activeTab = document.querySelector(`a[href="#comment-${activeClass}"]`);
      if (activeTab) {
        activeTab.click();
      }
    }
  });
  if (CONFIG.comments.storage) {
    window.addEventListener('tabs:click', event => {
      if (!event.target.matches('.tabs-comment .tab-content .tab-pane')) return;
      const commentClass = event.target.classList[1];
      localStorage.setItem('comments_active', commentClass);
    });
  }
</script>
</div>
  </main>

  <footer class="footer">
    <div class="footer-inner">


<div class="copyright">
  &copy; 
  <span itemprop="copyrightYear">2022</span>
  <span class="with-love">
    <i class="fa fa-heart"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">一年春又来</span>
</div>
  <div class="powered-by">由 <a href="https://hexo.io/" class="theme-link" rel="noopener" target="_blank">Hexo</a> & <a href="https://theme-next.js.org/mist/" class="theme-link" rel="noopener" target="_blank">NexT.Mist</a> 强力驱动
  </div>

    </div>
  </footer>

  
  <script src="https://cdn.jsdelivr.net/npm/animejs@3.2.1/lib/anime.min.js"></script>
<script src="/js/utils.js"></script><script src="/js/motion.js"></script><script src="/js/schemes/muse.js"></script><script src="/js/next-boot.js"></script>

  
<script src="/js/local-search.js"></script>






  





</body>
</html>
